Security

Last updated: October 12, 2026

This page describes how Holon Technology protects institutional data. It is written to answer the questions that come up in higher-education security reviews, and it describes what is actually in place today rather than what is planned. Where something is a known limitation, it says so.

1. What Holon stores

Holon tools run inside Canvas as LTI applications. Most of what you see in a Holon tool is read from Canvas at the moment you look at it and is not retained. What we do store:

• Launch sessions — the Canvas user id, name, email, course and role supplied by Canvas in the LTI launch, so the tool knows who you are. Purged after 30 days.
• Canvas API tokens — encrypted at rest, used to act in Canvas on your behalf.
• Your configuration — term and session definitions, course trackers, readiness plans, saved settings and job history for the work the tools perform.
• Account records — for customers who purchase directly: name, email, licence key and order history.

Holon does not store student coursework, grades, or submissions. Where a tool reports on student activity (for example last date of attendance or at-risk flags), it reads that from Canvas at run time and caches only the summary needed to display the current view.

2. Where data is held

All services run on DigitalOcean infrastructure in the United States — compute in the New York (NYC3) region, encrypted backups in the San Francisco (SFO3) region. Data is not replicated outside the United States.

3. Sub-processors

Holon uses the following sub-processors. Each is used for the stated purpose only.

• DigitalOcean — hosting and encrypted backup storage (United States).
• Stripe — payment processing for direct purchases. Card details go to Stripe and are never seen or stored by Holon.
• Resend — transactional email (licence delivery, system alerts).
• Anthropic — the optional AI features. AI is off unless an institution supplies its own API key; when enabled, the content of the request is sent to Anthropic to generate the response. No AI feature runs without that key in place.
• Let's Encrypt — TLS certificates.

We will give customers at least 30 days' notice before adding or replacing a sub-processor, and a customer may object in writing within that period.

4. How data is protected

In transit

All traffic is HTTPS. TLS 1.2 and 1.3 only; TLS 1.0 and 1.1 are disabled. HSTS is enforced.

At rest

Canvas API tokens and licence keys are encrypted with AES before they are written to disk. Backups are encrypted. Application secrets are held outside the application directories with owner-only permissions and are never committed to source control.

Access control

Every request to a Holon tool must carry a valid LTI launch session; routes are default-deny, meaning a route is closed to unauthenticated callers unless it is explicitly opened. Administrative functions additionally verify the caller's Canvas account-admin role against Canvas itself rather than trusting the launch. Each tenant's data is scoped to its Canvas domain at the query level.

Separation

Each service runs as its own unprivileged system user with a read-only filesystem apart from its own data directory, so a fault in one tool cannot reach another tool's data or secrets.

Browser protections

A strict Content-Security-Policy is applied with no inline script execution. Framing is restricted to known Canvas origins. Launch tokens are sent as request headers rather than in URLs, and are redacted from server logs.

5. Retention

• Launch sessions — 30 days, then deleted automatically.
• Server access logs — 14 days, with credentials redacted.
• Database backups — taken every six hours, 14 retained, mirrored to encrypted offsite storage.
• Configuration and account records — kept for the life of the agreement, then deleted within 30 days of a written request or of the agreement ending.

An institution may request export or deletion of its data at any time by writing to [email protected].

6. Availability and recovery

Databases are backed up every six hours and mirrored offsite hourly. Application secrets are held in a separately encrypted offsite archive so that a complete host loss is recoverable. Restores are rehearsed, not assumed — the most recent rehearsal was October 12, 2026, restoring all customer-facing databases from the offsite copy with integrity checks and a service boot against the restored data. Service availability is monitored every five minutes from infrastructure separate from the production host, so an outage is detected even when the production host is the thing that has failed.

7. Development practices

Changes reach production through an automated gate: a regression suite against a staging Canvas instance, a buyer-path smoke test, and static checks for unescaped output and unsafe patterns. A change that fails any of these is refused. Every promotion is recorded with a backup of the previous version so it can be rolled back.

8. Reporting a vulnerability

Email [email protected] with "Security" in the subject. We will acknowledge within two business days and keep you informed until the issue is resolved. Please give us a reasonable period to remediate before publishing. We will not pursue legal action against researchers who report in good faith and do not access or modify data beyond what is needed to demonstrate the issue.

9. Incident notification

If a breach affects an institution's data, we will notify the institution's named contact without undue delay and within 72 hours of becoming aware of it, with what we know at the time, what we are doing, and what the institution may need to do. We will follow up as the picture develops rather than waiting for a complete one.

10. Honest limitations

Holon Technology is a small company, and institutions deserve to know what that means:

• Holon has not completed a SOC 2 audit. The practices above are real but are not independently certified.
• Services run on a single production host with offsite backups and a rehearsed recovery procedure. There is no hot standby; recovery from a total host loss would take hours, not minutes.
• A HECVAT is available on request for institutions that need one for procurement.

11. Contact

Holon Technology LLC
A Florida limited liability company · Florida Document No. L26000526857
7243 Heaven Ln, Fort Myers, FL 33908, United States
Mailing address: 10020 Coconut Rd, Ste 138 #5032, Estero, FL 34135, United States
[email protected]